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IN THE UNITED STATES DISTRICT COURT FDR 


EASTERN DISTRICT OF VIRGINIA 
Alexandria Division 





m 




UNITED STATES OF AMERICA 

UNDER SEAL 

V. 

Case No. I:20-mj-4 

JOHN WILLIAM KIRBY KELLEY, 
a/k/a “Carl,” 
a/k/a “BotGod” 

Defendant. 


AFFIDAVIT IN SUPPORT OF A 
CRIMINAL COMPLAINT AND ARREST WARRANT 

I, Jonathan Myles Lund, being first duly sworn, do hereby depose and state as follows: 

Introduction and Agent Background 

1. I am a Special Agent with the Federal Bureau of Investigation (“FBI”) and currently 
assigned to the Cyber Crime Squad of the Washington Field Office. I have been employed by the 
FBI since 2009. 

2. In the course of conducting or participating in criminal investigations, I have been 
involved in interviewing and debriefing witnesses and infoimants; conducting physical surveillance; 
tracing and analyzing internet protocol addresses; tracing and analyzing financial transactions; 
analyzing telephone pen registers; collecting and analyzing evidence; and preparing and executing 
search warrants. I have received organizational sponsored computer training as well as computer 
training at the SANS institute. I have also received training in the area of computer security and 
network administration. 

3. This affidavit is submitted in support of a criminal complaint and arrest warrant, 
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charging JOHN WILLIAM KIRBY KELLEY (“KELLEY”) with conspiracy to commit an offense 
against the United States; to wit, interstate threats to injure, in violation of Title 18, United States 
Code, Section 875(c), all in violation of Title 18, United States Code Section 371. 

4. The facts in this affidavit are based on my investigation, personal observations, 
training and experience, as well as communications with others who have personal knowledge of the 
events and circumstances described herein. Because this affidavit is limited in purpose, I am not 
including all facts known to law enforcement concerning this investigation. 

Definitions 

5. The Onion Router, also known as “TOR,” is an open-source publicly available 
software that enables anonymous activity on the internet. TOR operates on the part of the internet 
that cannot be accessed using traditional internet browsers such as Google or Bing. This area of the 
internet is sometimes called the “dark web” or “dark net.” TOR directs traffic through a worldwide 
network of computers to conceal a user’s true geographic location and online activity. The TOR 
Network makes it possible for users to operate websites in a manner that conceals the true internet 
protocol (IP) addresses of the computers that host the websites. TOR identifies these websites as 
“hidden services.” Like other websites, hidden services are hosted on computer servers that 
communicate through IP addresses. 

6. An Internet Relay Chat (IRC) is similar to an internet chat room in that it allows for 
both one-on-one and group communication discussion in “forums,” also known as “channels.” An 
IRC is hosted on a server. Individual participants or “clients” connect to the server in order to 
transfer communications in the form of text to other clients connected to the server. 

7. “Swatting” is a harassment tactic that involves deceiving dispatchers into believing 
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that a person or persons are in imminent danger of death or bodily harm and causing the dispatchers 
to send police and emergency services to an unwitting third party’s residential address. 

8. “Doxxing” is a harassment tactic that involves researching and publishing personally 
identifiable information (PII) about an individual, such as the person's date of birth, address, 
telephone number, or other unique identifiers, on the internet. PII can be obtained in a variety of 
ways, both legal and illegal. 

PROBABLE CAUSE 

A. Background on the Investigation 

9. The investigation of KELLEY began when Old Dominion University Police 
Department (“ODUPD”) received a swatting call from an unknown number on November 29,2018. 
ODUPD contacted the FBI for assistance in analyzing the forensic evidence in the case. 

10. During the course of this investigation, law enforcement connected this swatting call 
to ODU with a number of other swatting calls. As I will explain below, there is probable cause to 
believe the ODU swatting call was perpetrated by individuals conspiring together on two dark web 
sites. The Deadnet IRC channel, also known by the moniker “#Graveyard, was used by the 
conspirators to communicate about swatting calls taking place. The conspirators would post internet 
links to live videos of swatting events. The conspirators also posted past swatting events for 
entertainment and bragging. The conspirators selected high profile targets including government 
officials, executives, and journalists. Individuals streaming live videos were also targeted because 
the conspirators wanted to see how law enforcement responded to the swat calls. The conspirators 
also appear to share racist views, with particular distain for African Americans and Jewish people. 
As I will explain below, the conspirators targeted a predominately African American church in Old 
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Town Alexandria, Virginia, which is located in the Eastern District of Virginia. 

11. The conspirators also maintained a second dark web site known as DoxBin. The site 
was a repository of the personally identifiable information of potential and past swatting targets. The 
conspirators indicated that an individual had been swatted by placing a gun next to the name of the 
person swatted. The DoxBin website primarily targeted government officials, executives, and 
journalists. 

12. The conspirators conducted hundreds of swatting calls across the United States, 
Canada, and the United Kingdom. The conspirators were able to conceal their true identity by using 
Voice over Internet Protocol (VoIP). The VoIP calls were made using Google Voice with email 
accounts kasseybaby99.s@gmail.com, jhulxol000@gmail.com, and other email addresses. In 
setting up these accounts, the conspirators used information not readily attributable to the 
conspirators. Google logged the calls placed by many of the accounts used for swatting calls. The 
accounts required an email and password to access the accounts, which limited who could use the 
accounts. 

13. Law enforcement have determined that hundreds of swatting calls are related for a 
number of reasons: (1) the use of email addresses which included the moniker “kasey” and “kayla”; 
(2) discussions the conspirators had in the IRC chat where they claimed credit for the calls and 
discussed some of the swatting events in real time; and (3) the controlled access to the Google Voice 
accounts used to make the calls. 

14. Law enforcement have determined that the primary voices on the swatting calls 
belong to two of the co-conspirators (“Co-Conspirator 1 ” and “Co-Conspirator 2”). Co-Conspirator 
2 also hosted the dark web sites Deadnet IRC and DoxBin, which, as I explained above, conspirators 
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used to discuss the swatting calls. KELLEY using the moniker “carl” when he participated in a 

supportive role hosting the #Graveyard IRC channel on the Cleamet before it was moved to the dark 

web. KELLEY also identified targets to swat and conducted research to determine the targets 

physical location in order to direct a swat response to the location of the live video feed. 

B. Kelley’s use of the Moniker “Carl” in the # Graveyard IRC channel and 
Overt Acts in Furtherance of a Conspiracy to make Threats to Injure 

15. During the course of this investigation, past participants of the Deadnet IRC channel 
have provided chat logs to law enforcement. 

16. Based upon a review of the IRC chat logs, I submit there is probable cause to believe 
that individuals using the moniker “Co-Conspirator 1”^ and “carl,” among others have conspired to 
issue numerous threats to injure in the United States, including in the Eastern District of Virginia. 

Below, I will detail some of the IRC chat logs that provide an overview of the conspiracy and show 

( 

that KELLEY, who was using the moniker “carl,” conspired with others to issue threats to injure. 

17. On or about November 4,2018, KELLEY participated in the Deadnet IRC channel. 
In the IRC channel, KELLEY used the moniker “carl.” I know KELLEY used this moniker because 
KELLEY recorded a video and referred to himself as “carl.” In the video, KELLEY discussed how 
he came to use the moniker “carl.” KELLEY stored the video on his 500 GB Seagate hard drive, 
which law enforcement later searched pursuant to a search warrant. Further, one of KELLEY’s 
conspirators and friends (“Individual 1 ”) informed law enforcement that KELLEY used the moniker 
“carl” on the Deadnet IRC. Individual 1 has met KELLEY in person. Individual 1 is cooperating 
with law enforcement because he is currently charged by state authorities. His charges arise out of 

1 “Co-Conspirator 1” was not the actual moniker; rather, I have changed the moniker in an effort to protect the 
ongoing investigation. 
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his role in the swatting conspiracy. Individual 1 is cooperating because he hopes that the state 
authorities will dismiss his charges. Individual 1 was not entirely forthcoming during his first 
interview with law enforcement; however, he has since been more forthcoming and I believe his 
information is reliable. 

18. After reviewing IRC chat logs, law enforcement identified a number of conversations 
where participants on the IRC channel were coordinating and conducting swatting calls. On multiple 
occasions Co-Conspirator 1 asked the participants to identify new swatting targets, as detailed in the 
below conversation. 

[16:05] <Co-Conspirator 1> find another target 

[16:05] <Co-Conspirator 1> find another target 

[16:05] <Co-Conspirator 1> find another target 

[16:08] <~Zim> who did you swat 

[16:11] <~GLITCH> niggers 

[16:11] <Co-Conspirator 1 > nothing yet 

[16:11] <Co-Conspirator 1> ive got a target though 

[16:11] <Co-Conspirator 1> https://wvm.youtube.com/watch?v=SUSrYUd-j30 
[16:11] <Co-Conspirator 1> vape store 

19. Based on my training, experience, and knowledge of this investigation, I believe Co- 
Conspirator 1 is making a request of everyone on the Deadnet IRC to identify a target to conduct 
swatting calls against. The group’s neo-Nazi ideology is apparent in the racial tones throughout the 
conversation logs. Prior to this conversation, KELLEY left the IRC channel and did not see the 
request from Co-Conspirator 1 to identify swatting targets. 
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20. KELLEY returned to the Graveyard channel nearly two hours after Co-Conspirator 1 
requested new targets and without prompting provided a live streaming video feed to target for 
swatting calls. 

[18:02] <0 04~carlD >back 

[18:02] <fl 04~carlD > got new flavors 

[18:02] <+saevyl> hey carl [Co-Conspirator 1] is swatting 

[18:02] <fl 04~carlO > for my dragon dick 

[18:02] <0 04~carlD > for real? 

[ 18:02] <+saevyl> yep 

[18:02] <0 04~carlD > is he in mumble 

[18:02] <0 04~carlD >loldongs 

[18:02] <+saevyl> just “shot his gf with an arl5” 

[18:02] <+saevyl> https://www.youtube.com/watch?v=HPD05-KwZbI 

[18:02] <0 04~carlD > fucing legend 

[18:02] <0 04~carlD > what mumble 

[ 18:02] <Co-Conspirator 1 > just told them to get back 

[18:03] <Co-Conspirator 1> or else i kill the kids 

[18:03] <0 04~carlD >what 

[18:03] <0 04~carlD >mumbleR 

[18:03] <D 04~carlD > mumble 

[18:03] <Co-Conspirator 1> im not in one m 

[18:03] <0 04~carlD >OOF 
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[18:03] <+saevyl> can I stream mumble through vie? 

[18:03] <&zheme> hey carl 

[18:03] <+saevyl> does it work like that? 

[18:03] <D 04~carlD > get in mumble, it will be funnier 

[18:03] <0 04~carlD > sup zheme 

[18:03] <& zheme > what falvor 

[18:03] <& zheme > for ur vape 

[18:03] <0 04~carlD >uhh 

[18:03] <0 04~carlD > give me a min 

[18:04] <Co-Conspirator 1> ambulance loldongs 

[18:05] <0 04~carlD > https://www.youtube.com/watch?v=pQuZfOaczgw 
[18:05] <0 04~carlD > next target 

21. Based on my training, experience, and knowledge of this investigation, I believe 
KELLEY provided a YouTube link above and identified the link as the next swatting target. It is 
important to note KELLEY was not present for the request from Co-Conspirator 1 to identify targets. 
Instead, it appears that KELLEY made the effort to search YouTube, identify the target, and then 
offer it to his co-conspirators without prompting. 

22. As the swatting call progressed, the group struggled to provide live audio of the 
swatting call. KELLEY offered to help troubleshoot the issue. Once the audio was restored, 
KELLEY asked if it was too early to record the call without being detected. 

[19:09] <~Co-Conspirator 1> can u hear the beep 
[19:09] <~Zim> heard a beep 
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[19:09] <@wil_> mumble address? 

[19:09] <~Zim> ye 
[19:09] <@wil_> cam? 

[19:09] <~ Co-Conspirator 1> okay finally 
[19:09] <~ Co-Conspirator 1> it was windows 
[19:09] <~Zim> loldongs 
[19:09] <~ Co-Conspirator 1> privacy settings 
[19:10] <~Zim> what is the beep 
[19:10] <~ Co-Conspirator 1> phone line 
[19:10] <0 04~carlD >ah 
[19:10] Co-Conspirator 1> he’ll talk soon 
[19:10] <0 04~carlO > thought it was my song 
[19:10] <~Zim> hi dave 

[19:10] <0 04~carlD > WERE HERE TO HELP YOU 
[19:10] <~Zim> dave is a professional negotiator 
[19:10] <0 04~carlO > can I start recording 
[19:10] <0 04~carlD > or will it pick that up 
[19:10] <~Zim> do it 
[19:10] <~Zim> “as long as needed” 

[19:11] <~ Co-Conspirator 1> record 
[19:11] <0 04~carlD > im going 

23. Based on my training, experience, and knowledge of the investigation, the co 
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conspirators are struggling with technical issues while attempting to share the audio of the swatting 
call. KELLEY in bold letters reaffirms that the co-conspirators on the call are all willing to help Co- 
Conspirator 1, who is the voice of the swatting call. KELLEY continued to engage by recording the 
call. This is significant because the calls are often posted online for others to view. Thus, creating a 
following for the swatting calls and helping to promote the group’s neo-Nazi agenda. 

24. After the swatting call ended, BCELLEY offered another target for the following day. 

KELLEY offered Old Dominion University (“ODU”), which was the college he was attending, as a 
potential target to call. ODU is located in Norfolk, Virginia, which is within the Eastern District of 
Virginia. Co-Conspirator 1 asked for KELLEY’s edu email in order to establish a Facebook account. 
[20:02] <0 04'-carlD > do my college tomorrow 
[20:04] <~ Co-Conspirator 1> maybe 
[20:04] <~ Co-Conspirator 1> carl 
[20:04] <&zheme > sam woodwards hearing is on the 9th 
[20:04] <~ Co-Conspirator 1> do u know the login for the edu email u have 
[20:06] <0 04~carlO > yeah 
[20:06] <0 04~carlD > its in my old dm 
[20:06] <0 04~carlD > Isec 

[20:06] <~ Co-Conspirator 1> use it to make a facebook account 
[20:06] <~ Co-Conspirator 1> then send me the login for the fb account 
[20:06] <~ Co-Conspirator 1> so i can dox younow 
[20:07] <0 04~carlD > can you just uhh 
[20:07] <0 04~carlD > use a temp email 
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[20:07] <0 04~carlD > use mine 

[20:07] <~ Co-Conspirator 1> no 

[20:08] <@wil> who tf is younow 

[20:08] <0 04~carlD > why do you need an edu 

[20:08] <~ Co-Conspirator 1> because it will pass sms verification 

[20:08] <0 04~carlD > oh alright 

25. Based on my training, experience, and knowledge of the investigation, KELLEY is 
offering his college, ODU, as a swatting target. The following conversation and requests from Co- 
Conspirator 1 focus on making the swatting call allowing for anonymity. Additionally, “zheme” 
reminds the co-conspirators about a court hearing in the Sam Woodward murder case. Law 
enforcement believe Sam Woodward is associated ^vith Atomwaffen Division, which is an extremist 
neo-Nazi group. Investigators believe Sam Woodward’s anti-Semitic views, in part, motivated him 
to commit murder. KELLEY and other co-conspirators are affiliated with or have expressed 
sympathy for Atomwafen Division. 

26. On November 6, 2018, KELLEY reminded participants on the IRC channel about 
swatting his college tomorrow in order to avoid class. 

[04:43] <0 04~carlD > fucking Imaoooooooo 

[04:43] <D 02~slimeboxD > fer reals 

[04:43] <0 02~slimeboxD > they are pist 

[04:43] <0 02~slimeboxD > 92 91 90 

[04:43] <+Zim_> Yeah they are 

[04:43] <0 04~carlD > good job [Co-Conspirator 1] 
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[04:43] <+Zim_> angy 

[04:43] <0 02~slimeboxD > he dun it hard 

[04:44] <0 04~carlD > https://my.mixtape.moe/hrtzps.png 

[04:44] <0 04~carlD > hopefully we get a better crew next time 

[04:44] <0 02~slimeboxD > whole town shut down, the citizens all shook an 

scurrd now 

[04:44] <0 04~carlO > this was the best by far tho 
[04:44] <0 04~carlD > AHAHHAHAHHA 
[04:44] <+Zim_> This was hilarious yeah 

[04:44] <0 04~carlD > norfolk next, I dont want to goto class on wed 
[04:44] <0 02~slimeboxD > ok saving it 

27. Based on my training, experience, and knowledge of the investigation, KELLEY is 
reminding the co-conspirators about his college as a future swatting target. The conversation about 
the swatting event is related to the call made on November 4, 2019, to a vape shop in New Hope, 
Peimsylvania. In response to that swattiiig call, local law enforcement issued a shelter in place for 
the small commimity. 

28. On or about November 29, 2018, at approximately 2:08 a.m., ODUPD received a 
phone call from a blocked number. The caller stated they were armed with an AR-15 and had placed 
multiple pipe bombs within the campus buildings. The caller disconnected the first call with 
ODUPD and called back at 2:26 a.m. 

29. At approximately 4:56 a.m., ODUPD received a phone call from (XXX) XXX-0622. 
During the call, the individual apologized for making an accidental phone call. The dispatcher then 
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contacted the investigating officer about this phone call. ODUPD compared the voice in the 
threatening phone call to the call received at 4:56 a.m. and determined that the two calls were likely 
made by the same individual. ODUPD identified the caller as KELLEY using school records 
provided by KELLEY, which listed his phone number. 

C. Interview of John Kelley 

30. On or about November 28,2019, ODUPD located and interviewed KELLEY. After 
being advised of his Miranda rights and waiving those rights, law enforcement interviewed 
KELLEY. KELLEY admitted that he dialed the campus police phone number; however, KELLEY 
stated he placed the call by accident. KELLEY also stated that he was a cyber-security major at 
ODU. 

31. When ODUPD asked KELLEY whether he was involved in the threatening call 
earlier that day, KELLEY stated: “I have been around for calls in the past.” KELLEY later 
discussed his time spent reviewing swatting calls and videos on YouTube and Twitter. When the 
officers attempted to ask follow-up questions about KELLY’s past involvement in swatting, 
KELLEY requested an attorney. 

3 2. During the interview, KELLEY provided consent to search his cellular devices, which 
included a white Apple iPhone and a black Blu phone. KELLEY also provided consent to search his 
dorm room, which was located on campus. During the search of KELLEY’s room, law enforcement 
located a laptop and multiple electronic storage devices. Law enforcement also located a 
prescription bottle of quetiapine. When questioned, KELLEY stated the bottle belonged to him, but 
that he was no longer taking the medication. This is significant because the caller during the bomb 
threat phone call stated he was prescribed an anti-psychotic known as “quetiapine,” commonly 
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known as Seroquel. By way of background, Seroquel is commonly prescribed to treat schizophrenia, 
bipolar disorder, and depression. 

D. IP Addresses Used for the ODU Swatting Call Link it to the Broader 

Swatting Conspiracy 

33. After the aforementioned bomb threat was called in to ODUPD on November 29, 
2018, and the subsequent phone call by KELLEY at approximately 4:56 a.m., ODUPD made an 
exigent request of Verizon to identify the phone number used to make the bomb threat. Verizon 
informed ODUPD the service provider was Cox Communications. Cox Communications provided 
the phone number and associated IP of the calls: 

a. 2:08 - 7607058888 IP 69.252.226.123:5060; and 

b. 2:26 - 7607058888 IP 69.241.14.218:5060. 

34. Both IP addresses were searched through whois.domaintools.net and returned to 
Comcast. Comcast informed ODUPD the phone numbers were associated with Bandwidth.com and 
the phone calls in question merely passed through their servers and did not originate there. 
Bandwidth.com informed ODUPD the phone number in question belonged to Google. Google 
informed law enforcement the two phone calls were placed by the Google subscriber over VoIP at 
2:08 a.m. and 2:26 a.m. to 7576834000. The Google Subscriber information provided as follows: 

a. Name: Bob Smitters 

b. Email: kasevbabv99.s@gmail.com 

35. The email address is significant because it follows a pattern of other email addresses 

used to conduct swatting events. Examples of the other email addresses are 

kaseykaykayxoO@gmail.com, kaseyxo2001xo@gmail.com, and jhullxolOOO@gmail.com. The 
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email addresses were used to make swatting calls through Google Voice and are linked to the group 
by IP addresses used. 

36. On December 4,2018, at approximately 7:03 a.m., ODUPD received another phone 
call from a blocked number on their non-emergency line. During the call, the caller stated he was 
located in the Webb Center and that he was in possession of a 9mm Glock and was going to shoot 
everyone in the building. The caller either played a prerecorded swatting or played excerpts from the 
prior swatting call made to ODU on November 28, 2018. 

E. KELLEY’S Continued Activities in Furtherance of the Conspiracy 

37. On December 5, 2019, the logs from the Deadnet IRC show co-conspirators 
discussing KELLEY’s contact with law enforcement. 

[02:48] <+saevyl> what happened to carl 
[02:48] <+saevyl> did he sleep 

[02:48] <0 02~slimeboxD > you guys ratted him out on the swat 

[02:48] <0 02~slimeboxD > he got busted 

[02:49] <~ A > BATTERING RAM 

[02:49] <~ A > HJOLY FUCK ITS GONNA GET REAL 

[02:49] <0 02~slimeboxD > shit got seized 

[02:49] <~A> https://www.youtube.com/watch?reload=9&v=90H8iRbXEqk <— 
cam 

[02:49] <0 02~slimeboxD > hope you guys ar happy 
[02:49] <0 02~slimeboxD > sell out ur own friend 
[02:49] <0 02~slimeboxD > :/ 
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[02:49] <0 02~slimeboxD > all he ever did was be nice to you 
[02:49] <0 02~slimeboxD > and this is how you repay him 
[02:50] <0 02~slimeboxD > he probby never getting his stuff bacvk 
[02:50] <D 02~slimeboxD > :( 

[02:51] <+saevyl> they goin in 

[02:52] <0 02~slimeboxD > u guys still dont even car 

Break in IRC Included 

[03:05] <~ 4 > he burnt himself 

[03:05] <~slimebox> assfags 

[03:05] <~ 4 > and we care 

[03:05] <~slimebox> not what he says 

[03:05] <'-slimebox> he says u ratted him 

[03:05] <~slimebox> he took the fall 

[03:06] <~slimebox> and i believ him 

[03:06] <~ 4 > >ratted 

[03:06] <~slimebox> feel sad for u guys 

[03:06] <~slimebox> if ur guys 

[03:06] <~slimebox> check to see if u got any balls still 

[03:06] <~slimebox> :P 

[03:06] -irc.supeijail.org- *** umode q: 4 tried to kick you from channel 
#graveyard (:P) 
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[03:06] 

[03:06] 

[03:06] 

[03:06] 

[03:06] 

[03:06] 

[03:07] 

[03:07] 

[03:07] 

[03:07] 

[03:07] 

[03:07] 

[03:07] 

[03:07] 

[03:07] 

[03:07] 

[03:07] 

[03:08] 

[03:08] 

[03:08] 


<~Co-Conspirator 2^> loldongs 

* ~slimebox grieves for carl 
<~slimebox>:( 

<~ Co-Conspirator 2> your being a massive faggot 
<~ A > slimebox are you a bint 

* -slimebox gets a teardrop fag tat for fallen carl 
<~slimebox> k im done 

<- Co-Conspirator 2> Carl fucked himself over 

* -slimebox sets mode: -asshole slimebox 
<+saevyl> how so [Co-Conspirator 2]? 

<-slimebox> i apologize 

<+saevyl> hes doing fine 
<+saevyl> aside from the bugged apartment 
<-slimebox> he moved into a refrigerator box 
<- Co-Conspirator 2> he called the campus police 
<~ Co-Conspirator 2> not me 
<- Co-Conspirator 2> or [Co-Conspirator 1] 
<-slimebox> his toilet is a paint can 
<-slimebox> but ya hes ok 

<-slimebox> he steals mcdonalds wifi for internet now 


2 “Co-Conspirator 2” was not the actual moniker; rather, I have changed the moniker in an effort to protect the 
ongoing investigation. 
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[03:08] <~ Co-Conspirator 2> you just said we ratted on carl 

38. Based on my training, experience, and knowledge of the investigation, I believe the 
co-conspirators are discussing KELLEY’s contact with law enforcement after the ODU swatting took 
place. One of the co-conspirators “slimebox” is accusing the others in the group of ratting out 
KELLEY. The response from Co-Conspirator 2 summarizes the view of the co-conspirators when 
he said “Carl fucked himself over.” I believe this refers to BCELLEY’s call to ODUPD after the 
swatting call. When KELLEY placed this call, he did so without obscuring his identity through the 
Google Voice account. 

39. On December 5, 2018, KELLEY re-entered the Deadnet IRC. KELLEY sought 
advice from Co-Conspirator 1 on moving the server and using VPNs in the Netherlands for 
operational security. Within a few hours, KELLEY was working to identify new swatting targets for 
his co-conspirators. 

[03:36] <~carl> slimebox: stop feeding niggas fake info 
[03:37] <~ A > ban him 
[03:37] <+saevyl> carl 

[03:38] <+saevyl> I understand everything now 
[03:38] <+saevyl> Lion is the final boss of the feds 
[03:38] <+saevyl> He’s the fed puppet master 
[03:38] <+saevyl> it’s the ultimate twist 
[03:39] <+saevyl> I guess thats them extracting them 
[03:42] <~carl> Imaoo 

[03:42] <~carl> thats why his opsec is so good 
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[03:43] <+saevyl> You kill all of the feds in the lower levels of the pentagon 

[03:43] <+saevyl> you take the elevator back up to the war room 

[03:43] <+saevyl> you know the one from Doctor Strangelove 

[03:43] <~carl> never watched it 

[03:43] <+saevyl> nigger what 

[03:43] <~carl> [Co-Conspirator 1] 

[03:43] <~carl> is .nl a good country for vpns and shit 

[03:43] <+saevyl> its 70 years old how have you never seen it 

[03:43] <~carl> thinking of dumping this server and getting one there 

[03:44] <~carl> because im gay 

Break in IRC Included 

[07:48] <~carl> momin 

[07:48] <~carl> slimebox: what u up to 

[07:56] <~Swatted'/> carl 

[08:02] <~carl> sup 

[08:03] <~carl> Swatted-/: 

[08:03] <~Swatted/> i need a cam 

[08:03] <~Swatted/> help me find a target carl 

[08:04] <~carl> kk 

[08:04] <~carl> u ever look into that shodan livemap? 

[08:04] <~carl> thought it was a bundle of shit tbh 
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40. Based on my training, experience, and knowledge of the investigation, I believe 
KELLEY returned to the Deadnet IRC for the first time since his contact with ODUPD following the 
swatting call. KELLEY’s first communication with Co-Conspirator 1 is to determine a country that 
provides greater anonymity online. KELLEY specifically asked if the Netherlands would be a good 
place for a virtual private network to obscure his true identity. Later in the same conversation, 
KELLEY engaged in a conversation about identifying live video feeds to target. Shodan, a website 
showing unsecured video feeds was specifically mentioned. I also note that the co-conspirators 
continue to use demeaning racial language. 

41. On or about December 10, 2018, the co-conspirators on the Deadnet IRC harassed 
KELLEY for swatting ODU. 

[18:12] <~Zim> First step, DON’T BOMB THREAT YOUR OWN SCHOOL 
[18:12] <~Zim> you hear that carl 
[18:12] <~Zim>>:( 

[18:13] <+ 4 _> carl u dummy 
[18:13] <@zovix> carl 

[18:13] * +Boruvkov has quit IRC (Read error) 

[18:14] <~ Co-Conspirator 2> Rule #1 If you call in a bomb threat to your own 
school, make sure you tell the school it was you. 

42. Based on my training, experience, and knowledge of the investigation, I believe the 
co-conspirators are harassing KELLEY because he identified his own university as a swatting target. 
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F. Expert Linguistics Analysis Conducted on the ODU Threat Calls, 

Kelley’s Accidental Call, and Law Enforcement Interviews 

43. ODUPD asked an ODU linguistics professor to conduct an analysis of the caller’s 
voice in the bomb threat call, KELLEY’s follow-up call, and the active shooter call. An ODU 
linguistics professor compared the three phone calls with the law enforcement interviews of 
KELLEY and another individual, who is KELLEY’s friend, to determine if either individual’s voice 
characteristics matched the voice characteristics of the threat calls. 

44. The professor produced a 43 -page report detailing her findings of the quantitative and 
qualitative measurements. Based on acoustic analysis of vowel formants and quantitative analysis of 
pitch data as well as qualitative analysis of consonants from select tokens taken from spectrogram 
data, the professor detemiined the following: 

• ODU Bomb Threat Calls and the Webb Threat Gall contain the same 
voice; 

• KELLEY’s voice is a match with the Threat Calls; and 

• The individual, who is KELLEY’s friend, is ruled out, i.e. is not a match. 

45. The United States Secret Service (“USSS”) independently compiled a conglomeration 

of voice recordings from various threat calls made to law enforcement, which are believed to be part 
of the broader conspiracy. The USSS Forensics Services Division (“FSD”) conducted a limited 
cursory analysis with an automatic speaker recognition system test. FSD supplied a four-page 
cursory report concluding the amount of speech contained in all of the recordings was less than the 
optimal amount for comparison by the automatic system, which could affect the reliability of the 
report. FSD concluded KELLEY’s voice is not a match for any of the threat calls made to law 
enforcement in this case, including the calls to ODU. 
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46. Based on the linguistic subj ect matter expertise of the ODU professor and the fact the 
USSS report stated its results could be unreliable, I submit the ODU professor’s conclusions are 
more reliable. 

G. Forensic Review of Kelley’s Devices 

47. On November 28,2019, KELLEY provided consent to search his dorm room. Within 
his dorm room were numerous computers and electronic storage devices. ODUPD obtained a search 
warrant on November 30, 2019, for the devices seized in the dorm room. The FBI was asked to 
assist in the forensic search of the electronic devices. 

48. A forensic review of an iPhone seized from KELLEY at the time of his interview on 
November 28, 2018, was conducted. A photo of tactical gear including a ballistic vest and plates 
along with a ballistic helmet are staged in a photo with a license plate. Law enforcement know that 
this photo was in possession of Jeffrey Clark, who was arrested on gun charges and was an associate 
of Robert Bowers. Bowers is currently indicted for his role in murdering and injuring Jewish 
individuals who were engaged in religious worship at the Tree of Life Synagogue in Pittsburg, 
Pennsylvania. Law enforcement also located multiple photos, in which KELLEY and other 
individuals are dressed in tactical gear holding assault style rifles. The faces of some individuals are 
concealed by masks and tactical helmets. There were photos of bumper stickers glorifying school 
shootings, and recruiting material for Seige and Atomwafen, which are white supremacist groups. 
There are also photographs on the device of hand guns and assault style rifles displayed on tables. 
Some of the weapons appear to be authentic and others appear to be life like replicas. 

49. A forensic review was also conducted on a black Staples thumb drive seized on 
November 28, 2018. During this search, ODUPD identified multiple documents that logged the 
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statements made on the Deadnet IRC channel. Review of these documents show countless examples 
of swatting activity over an extended period of time. 

50. A forensic review was also conducted on a blue Staples thumb drive seized on 
November 28,2019. During the review, law enforcement identified a group of videos that KELLEY 
created, which document KELLEY and other co-conspirators swatting a barber shop. KELLEY 
recorded the live video feed of the barber shop with the ongoing Deadnet IRC conversation over the 
video. As the conversation progressed, it appears law enforcement was not responding. A request 
for new targets was then made by Co-Conspirator 2. During the conversation, KELLEY offered two 
potential targets to swat. KELLEY described one of the individuals as a juvenile in Texas and the 
other individual as an adult in Michigan. ICELLE Y provided addresses for both and phone numbers 
for one of the targets. 

51. In another video, Co-Conspirator 2 and KELLEY are looking at live video feeds on 
the website younow.com for individuals to target. KELLEY attempted to identify the college of the 
individual live streaming from Florida to conduct a swatting call against the individual. 

52. In another video, KELLEY transitioned to stream.me and identified 
“cyberdemon531”, a gamer live streaming her activity, as a swatting target. KELLEY navigated on 
his computer to a web browser to do research and identify “cyberdemon531.” Other videos that 
KELLEY made show the female “cyberdemon531” leaving her live video stream and returning after 
an extended period of time. When she returned she confirmed to her live video feed followers that 
she was swatted. 

53. As KELLEY navigated through his computer while recording the swatting videos 
numerous identifying items could be seen. KELLEY was logged into his ODU email. A tab on 
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KELLEY’S web browser was logged into his ODU blackboard account. KELLEY was in the process 
of completing a survey for one of his classes referred to in his ODU email visible on the video. 
KELLEY logged into his accounts as the video was recording. 

H. Additional Swatting Calls in the Eastern District of Virginia that are 
Connected to this Conspiracy 

54. On or about November 3, 2018, the Alexandria Police Department (“APD”) 
responded to a bomb threat made against Alfred Street Baptist Church, which is located in 
Alexandria, Virginia, within the Eastern District of Virginia. 

55. On November 3, 2018, at approximately, 7:02 p.m., a caller used a blocked phone 
number to contact the Department of Emergency Communications (DEC) non-emergency 
administrative line. The caller identified himself as “George” and advised he placed three pipe 
bombs at the Alfred Street Baptist Church and was going to “blow it up.” The caller stated the word 
“shooting” and that the caller was going to kill eveiyone at the church. Additionally, the caller 
advised he had control over the bombs and would not specify their location. The call taker from 
APD determined the caller sounded muffled and out of breath during the conversation. The call 
taker also advised it sounded like a middle age, white male with a Hispanic accent. 

^ 56. APD responded to Alfred Street Baptist Church and set up a perimeter, evacuated its 
occupants, and used K9 units to sweep the interior and exterior of the building. The explosive sweep 
produced negative results and APD cleared the scene. After determining this was a false bomb 
threat, APD opened an investigation. 

57. During the course of the investigation, APD obtained records from Verizon indicating 

phone number XXX-XXX-8888 called DEC at 7:02 p.m. on November 3,2018. According to a law 
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enforcement database, this number returns to Bandwidth. Further investigation revealed the 
telephone number is a VoIP number and all subscriber information would be available through the 
wholesale customer, Google Inc. 

58. Google informed APD the Google email account kasevbabv99.s@gmail.com made 
the VoIP call to DEC. This is the same email address used to make the swatting call against ODU. 

59. On January 27,2019, at approximately 2:44 a.m., an individual called the APD non¬ 
emergency line and provided an address belonging to a USSS protectee. The caller stated he had an 
AR-15, shot and killed his girlfriend, had her two children tied up in the laundry room and he would 
kill them if he did not speak to the hostage negotiator, and that he had a pipe bomb that he would 
detonate. The caller’s voice is muffled and sounds as if he is out of breath. 

60. During the course of the investigation, APD obtained records from Verizon indicating 
phone number XXX-XXX-8888 called DEC at 2:44 a.m. on January 27,2019. According to a law 
enforcement database, this number returns to Bandwidth. Further investigation revealed the 
telephone number is a VoIP number and all subscriber information would be available through the 
wholesale customer, Google Inc. 

61. Google informed APD the Google email account ihullxo 1000@gmail.com made the 
VoIP call to DEC. 

62. IP addresses accessing kaseybaby99.s@gmail.com and jhullxo@gmail.com also 
accessed personal email accounts shown to pay for the dark web server supporting the hidden service 
DoxBin. During the time of the Alfred Street Baptist Church swatting call, Co-Conspirator 1 was 
logged into the kaseybaby99.s@gmail.com account using IP Address 46.246.12.44. Co-Conspirator 
1 was also logged into the Deadnet IRC channel using the same IP address. 
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63. Based on my training and experience, IP addresses are a unique identifier of internet 
access point at a point in time. Co-Conspirator 1 using the same IP address on two sites at the same 
point in time confirms he was the voice on the Alfred Street Church swatting. During interviews 
with a co-conspirator, the co-conspirator confinned he selected the Alfred Street Church because it 
was an African America church. The co-conspirator explained that he and the other co-conspirators 
are white supremacists and are sympathetic to the neo-Nazi movement. This co-conspirator 
confirmed that Co-Conspirator I was the voice on the call. The same Google Voice number XXX- 
XXX-8888 was used to place all the swatting calls identified in this affidavit. The email accounts 
used to make the calls had passwords limiting who would be able to access the accounts. 

64. • The below table shows additional calls made in the Eastern District of Virginia and 
internationally. The calls from 33 days are primarily from November and December of 2018 and 
impact 134 different law enforcement agencies. Law enforcement believe the co-conspirators are 
connected with other swatting calls and the below list puiposefully omits some of the calls. 


Agency 


Agency 

State/Prov 

Banff RCMP 


Fort Lee PD 

NJ 

Edmonton PD 

AB 

Manasquan PD 

NJ 

Lethbridge PD 

AB 

Montclair 

NJ 

Florence PD 

AL 

Monmouth County SO 

NJ 

Gulf Shores PD 

AL 

Albuquerque PD 

NM 

Kamloops RCMP 

BC 

Las Vegas Metro PD/SO 

NV 

Anaheim PD 

CA 

Little Valley SO 

NY 

El Cajon PD 

CA 

NYPD 

NY 

Hesperia PD 

CA 

Onondaga County SO 

NY 

Los Angeles PD 

CA 

Sag Harbor PD 

NY 

Los Angeles SD 

CA 

Schenectady PD 

NY 

Mum eta PD 

CA 

Southampton PD 

NY 

Palo Alto PD 

CA 

Suffolk County SO 

NY 

Richmond PD 

CA 

Syracuse City PD 

NY 
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Agency 


State/P rov 


Agency 


State/Prov 


Sacramento County 
SO 

CA 

Yorkville Village PD 

NY 

San Bernardino Ca 

CA 

Cincinnati PD 

OH 

San Bernardino SO 

CA 

Cleveland PD 

OH 

San Francisco PD 

CA 

Columbus PD 

OH 

San Jose PD 

CA 

Dayton PD 

OH 

Santa Clara REACT 
TF 

CA 

Deshler PD 

OH 

Santa Rosa PD 

CA 

Fairborn PD 

OH 

Denver PD 

CO 

Henry County SO 

OH 

Boca Raton PD 

FL 

Hilliard City PD 

OH 

Deltona PD 

FL 

Marion PD 

OH 

Ft. Myers PD 

FL 

North Kingsville PD 

OH 

Jackson Beach PD 

FL 

Norwalk PD 

OH 

Key West Fire 

FL 

Warren PD 

OH 

Miami Beach PD 

FL 

Zanesville PD 

OH 

Oakland Park PD 

FL 

Oklahoma City FAA 

OK 

Orlando PD 

FL 

Oklahoma City PD 

OK 

Sanford PD 

FL 

Bancroft PD 

ON 

Stuart PD 

FL 

Grand Sudbury PD 

ON 

Volusa County SO 

FL 

Ontario Prov. Police 

ON 

Americus PD 

GA 

Toronto PD 

ON 

Atlanta PD 

GA 

Ashland PD 

OR 

Dekalb County SO 

GA 

Bend PD 

OR 

Douglasville PD 

GA 

Eugene PD 

OR 

Eatonton PD 

GA 

Malheur County SO 

OR 

Fulton County 
DMH 

GA 

Portland PD 

OR 

Lithonia PD 

GA 

Borough of Kutztown PD 

PA 

Honolulu PD 

HI 

Bristol Township PD 

PA 

Lewiston PD 

ID 

New Hope PD 

PA 

Chicago PD 

IL 

Stroudsburg PD 

PA 

Elmhurst PD 

IL 

Tobyhanna J’ownship PD 

PA 

Hinsdale PD 

IL 

Montreal PD 

QB 

Mills County SO 

IL 

Quebec City PD 

QC 

Angola PD 

IN 

Sioux Falls PD 

SD 


Crawford PD 


Sturgis PD 
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Agency 

State/Prov 

Agency 

State/Prov 

Kansas City Police 

KS 

Arlington PD 

TX 

Cadiz PD 

KY 

Hardin County PD 

TX 

Barnstable PD 

MA 

Harris County SO 

TX 

Fenton PD 

MI 

Houston PD 

TX 

Prince George 

MD 

Pflugerville PD 

TX 

Jackson PD 

MI 

San Antonio PD 

TX 

Linden PD 

MI 

Summit County SO 

UT 

Livingston County 
SO 

MI 

Alexandria PD 

VA 

Muskegon County 
SO 

MI 

Chesapeake PD 

VA 

Oakland County SO 

MI 

Henrico SO 

VA 

Ottawa County SO 

MI 

Norfolk PD 

VA 

Trenton PD 

Ml 

Old Dominion Univ PD 

VA 

Village of Fruitport 
PD 

MI 

Seattle PD 

WA 

Zeeland Fire 

MI 

Middleton PD 

WI 

Grand Rapids PD 

MN 

Pleasant Prairie PD 

WI 

St. Louis Metro PD 

MO 

Marion County SO 

wv 

Codiac RCMP 

NB 

Laramie PD 

WY 

Boone Fire 

NC 



Charlotte- 

Mecklenburg 

NC 



Grand Island PD 

NE 



Conway PD 

NH 




1. KELLEY Charged with Drug-Related Offenses 

65, On or about January 31,2019, ODUPD responded to KELLEY’s residence because 
they received a report that “shrooms” were present in the room. KELLEY was present when law 
enforcement arrived. When presented with the bag of “shrooms,” provided to ODUPD by 
KELLEY’s roommate, KELLEY was initially evasive, but later admitted the “slirooms” belonged to 
him. Police made entry into the room and KELLEY was asked if there was anything else in the 


room. KELLEY informed law enforcement there were additional drugs in his room, including a 
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cactus plant used for extracting and ingesting mescaline and a bag containing three tabs suspected of 
containing Lysergic acid diethylamide (LSD). ODUPD then aiTesled KELLEY on state drug charges. 
After being charged, ODU expelled KELLEY from its campus. 

66. In the IRC chat logs found on KELLEY’s seized devices, KELLEY frequently 
discussed his usage of illegal substances. KELLEY also maintained pictures of illegal drugs 
consistent with the substances seized by ODUPD. 

Conclusion 

67. Based on the facts set forth above, I submit there is probable cause to believe that, 
JOHN WILLIAM KIRBY KELLEY, did unlawfully, knowingly, and willfully, combine, conspire, 
confederate, and agree with persons known and unknown to commit an offense against the United 
States, that is, to transmit in interstate commerce communications containing threats to injury the 
person of another, and that KELLEY or others did an act to effect the object of said conspiracy, in 
violation of Title 18, United States Code, Section 875(c), all in violation of Title 18, United States 
Code Section 371. 





rontflliai^'lVJ^tWs^ Lurin' 

Special Agent 

Federal Bureau of Investigation 


Sworn and subscribed to before me this ^ _day of Januaiy, 2020. 



isl 


The Honorable Theresa Carroll Buchanan 
United States Magistrate Judge 


Theresa Carroll Buchanan 
United States Magistrate Judge 
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